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10. A Bystem for reconstructing a sessina the system 
CDTT^riaing; 



a packet goutcc, the packet source generating a plurality 
of packets; 



a flow manager coupled to the packet source, Uie flow 
mtmager identifying at least one flow in the plurality of 
pacJcetB; 



an application recognizer coupled to the flow manager* 
the application recognizer identifying an application 
cQiTCSponding to the at least one flow; 



The Nanis Business Infrastrucuire Platform ia adapted to 
"reconstruct the trafTlc in real time, baaed on an 
appUcation^evel understanding of the IP traffic/* (See 
Appendix A) 

'*NARUS Analyzers deliver highly optimized data 
collection services to the platform. Analyzers are 
subaystema that non-intruaivdy detect, extract, and 
characterize in NARUS Virmal Analyzers are lightweight 
software agents that leverage industry standard protocoU, 
as wcU as proprietary data formats, lo extract information 
from variQUii network dcviceg and service elements that 
uansmit or terminate traffic/' (Sec Appendix B) 

IP traffic is referred to as "packets" in Appendix C. 

From this information taken in conibinatton with the 
related information in the Appendices and an inspection 
of the system as a whole, it can thus be inferred that the 
Narua Business Tnfrastmcnire Platfortn includes a packet 
source, the packet source generating a plurality of 
packets. 

The Narua Business Infrastructure Platform includes 
*' Analysers [that] access these network elements, retrieve 
session data, and parse various data formats to generate 
meaningful usage infonnaiion." (Sec Appendix B) 

See "NARUS Virtual Analyzers" in Appendix B. 

The Narua Business Infrastrucmre Platform includes a 
"NctFlow Virtual Analyzer [that] collects NeiFlow flows 
generated by Ciaco*s NciFlow-enabled routers and 
switches. Supported versions include v I . vS. v7, and v8." 
(See Appendix B) 

From this information taken in combination with the 
related information in the Appendices and an inspection 
of the system as a whole, it can thus be inferred that the 
Narus Business Infra&trucmre Platform includes a flow 
manager coupled to the packet source, the flow manager 
identifying at least one flow in the plurality of packets. 

The Nams Business Infrastructure Platform is adapted to 
"reconstruct the traffic in real time, based on an 
application-level understanding of the IP traffic." (See 
Appendix A) 

From this infonrmtion taken in combination with the 
related information in the Appendices and an inspection 
of the system aa a whole, it can thus be inferred that the 
Nams Business Infrastruchire Platform includes an 
application recognizer coupled to the flow manager, the 
application recognizer identifying an application 
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^ session streamer coupled to ihe flow manager, thts 
sesaioQ streamer identifying a plurality of flows in the 
plurality of packets concspondiPR to the session based 
on tbfi application. 



12. The system of cUim 10. wherein the application 
recognizer can identify at least one of a file n ^nafer 
protocol (FTP)» a hypertext transfer protocol (HTTP), a 
simple mail transport protocol (SMTP)* a donwin name 
service (DNS), a telnet protocol, a posi office protocol 
(POP), an Internet mcanage access protocol (IMAp). a 
network time protocol (NTP). a Net bios protocol, a 
network news transport protocol (NNTP), a network 
time protocol (NTP), a simple network management 
protocol (SNMP), an Internet Relay Chai(lRC) protocol, 
a H,323 protocol, a voice over IP protocol, a 
KctMoeting(TM) protocol, a Quicktime(TM) protocol, a 
»orv«r message block (SMB) protocol, a 
Real Audio(TM)protocol. a real time streaming protocol 
(RTSP). and a real-time transport protocol (RTF). 



corresponding to the at least one flow. 

The Narus Business Infrastructure Platform includes 
"technology to understand the acmantica of a user session 
across all seven layers of the network stack. (Sec 
Appendix D) 

See "NARUS Semantic Traffic Analyzers'* in Appendix 
B and D. 

The Nanis Business Infrastructure Platform includes 
^^Analyzexft [that) build a statistical repository of essential 
user session and application activity over lime. By using 
data filtering, transfornwtion, and aggregation techniques, 
they optimize data collection across all applications and, 
where applicable, repurpose the collected data for 
multiple applications" (Sec Appendix B) 

From this information taken in combination with the 
related information in the Appendices and an inspection 
of the system as a whole, it can thus be inferred that the 
Narus Busincs:» Infrastructure Platform includes a session 
streamer coupled to the flow manager, the session 
streamer identifying a plurality of Oows in the plurality of 
packets corresponding to the session based on the 
application. 

See also Appendix A-D. 

''The NARUS Platform is packaged with a variety of 
Virtual Analysers, some of which include general- 
purpose, standardA-based agents (e.g,SNMP, 
Radius and DNS), while others are custom and vendor 
specific (e.g. Cisco NetFlow, Cisco uOne, Lucent 
Bulkstat, and CocheFlow)." 

From this information taken in combination with the 
related information in the Appendices and an inspection 
of the system as a whole, it can thus be inferred that the 
Narus Business Infrastructxwe Platform includes an 
application recognizer that can identify at least one of a 
file transfer protocol (FTP), a hypertext transfer protocol 
(II'ITP), a simple mail transport protocol (SMTP), a 
domain name service (DNS), a telnet protocol, a post 
office protocol (POP), an Internet niessage access 
protocol (]MAP)i a network livnc protocol (NTP), a Net 
bios protocol, a network news transport protocol (NNTP), 
a network time protocol (NTP), a simple network 
management protocol (SNMP). an Internet Relay 
Chat(IRC) protocol, a H.323 protocol, a voice over IP 
protocol, a NetMeeting(TM) protocol, a Quicktimo(TM) 
protocol, a server message block (SMB) protocol, a 
RealAudio(TM)pTOtocol, a real time streBraing protocol 
(RTSP), and a real-time transport protocol (RTF). 
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